Construct validity threats relate to the selection and creation of IoT security dataset. As we include all tags related to IoT tags, security-related tags are also present there. However, there may be some security tags that have not been included in the dataset creation process. In the future, SO may include more IoT and security tags, which could challenge our dataset. However, as we discussed in Section REF , we observed that IoT developers in SO did not constrain their security-related discussions in SO to only questions labeled as security-related tags. In fact, more than 90% of our security-related sentences are not covered by the security-specific tags in our dataset. As such, in Section , we discussed the implications of our automated tool to detect security-related sentences in SO, which could find such sentences even in SO IoT tags that do not explicitly refer to any security issues. Beside this, construction validity threats relate to the difficulty of finding data to create our IoT security-related sentences. Our benchmark creation process was exhaustive, as we processed more than 53K posts from SO. The evolution of IoT topic categories considers post-creation time as sentence creation time. A post can be edited after its creation with new sentences, but we observed less than 1% of such cases in our dataset. We find security-specific 30K sentences out of 672K sentences in the IoT dataset using the best performing SecBot model. During the topic modeling phase, we observed only a few non-security related sentences. Further investigation can be carried on. This may give us more insights about the model, which we leave as our future task. In addition, we select a topic for each sentence based on the higher coherence score of the topics. During the topic labeling step, we label each topic by analyzing the topic top 30 words and posts associated with the label. This approach is consistent with the related work that also analyzed topics in SO posts [1]}, [2]}.
